Blinko Api

Manage Blinko notes and blinkos from the command line. Use when you need to list, create, update, delete, or promote blinkos.

Security Scan

The skill's code and instructions match its stated purpose (a small CLI client for a Blinko HTTP API); nothing requests unrelated credentials or installs arbitrary code, though the SKILL.md and metadata disagree about declared env requirements.

Purpose & Capability

Name/description (manage notes/blinkos) aligns with the included Python client which calls /v1/note/... endpoints. One minor inconsistency: registry metadata lists no required env vars, but the SKILL.md and the script read BLINKO_HOST and BLINKO_TOKEN (optional defaults applied). This is likely an omission in metadata, not a functional mismatch.

Instruction Scope

SKILL.md instructs the user to set BLINKO_HOST and BLINKO_TOKEN and to run the provided Python script for list/get/upsert/delete/promote operations. The runtime instructions only reference the API host/token and standard CLI use; they do not ask the agent to read arbitrary system files or exfiltrate unrelated data.

Install Mechanism

No install spec; skill is instruction-only plus a small bundled Python script. There are no downloads or install actions that would write or execute remote code.

Credentials

The script uses BLINKO_HOST and BLINKO_TOKEN from the environment (with sensible defaults: localhost and empty token). Because the registry metadata did not declare these as required, users may not be warned about needing an API token. Requiring a token for API access is reasonable, but ensure you only set BLINKO_HOST to servers you trust and keep BLINKO_TOKEN secret.

Persistence & Privilege

The skill is not always-enabled and does not request elevated privileges, persistent installation, or modification of other skills. It runs only when invoked and only performs outbound HTTP requests to the configured host.

Assessment

This skill is a small, self-contained Python CLI that talks to a Blinko HTTP API. It behaves as advertised: you should set BLINKO_HOST and BLINKO_TOKEN in your environment before use. Two practical checks before installing/using: (1) verify the BLINKO_HOST points to a server you control or trust (the script will send requests there), and (2) treat BLINKO_TOKEN like any API secret — don’t expose it in shared shells or logs. Note the registry metadata omitted the env variables used by the script; that mismatch is likely benign but worth being aware of. If you plan to let an agent call this autonomously, ensure the agent is allowed to talk to the configured host and that the token’s privileges are limited.

Blinko

Use the Blinko API from Python with host and token loaded from OS environment variables.

Usage

Set environment variables in your OS/session:

BLINKO_HOST=http://127.0.0.1:1111/api
BLINKO_TOKEN=your_token_here

List notes

python3 {baseDir}/scripts/blinko_client.py list-notes

Get a note

python3 {baseDir}/scripts/blinko_client.py get-note NOTE_ID

Upsert a note

python3 {baseDir}/scripts/blinko_client.py upsert-note --content "My note content"

Delete a note

python3 {baseDir}/scripts/blinko_client.py delete-note NOTE_ID

List blinkos

python3 {baseDir}/scripts/blinko_client.py list-blinkos

Upsert a blinko

python3 {baseDir}/scripts/blinko_client.py upsert-blinko --content "Quick thought"

Promote blinko to note

python3 {baseDir}/scripts/blinko_client.py promote-blinko BLINKO_ID

Notes

• Reads BLINKO_HOST and BLINKO_TOKEN from the OS environment.
• If BLINKO_HOST is missing, defaults to http://127.0.0.1:1111.
• Uses Blinko API note endpoints (/v1/note/...) for both notes and blinkos.
• Prints API responses to stdout; errors go to stderr with non-zero exit.